> even worse the service could be taken over by a malicious actor This particular problem is partly mitigated by subresource integrity (hashes of third party r

> even worse the service could be taken over by a malicious actor This particular problem is partly mitigated by subresource integrity (hashes of third party resources you put in the html tag). For my money, there are plenty of situations where third-party resources are acceptable. Ultimately that is basically what a CDN is, which most serious websites rely heavily on (often sharing their SSL certs).